Deployment Architecture

Steps to add additional storage to Indexers in cluster


Hi Splunkers ,

Our splunk indexers disk has reached 90% and decided to extend the capacity. We have 3 indexers in cluster . What are the steps to be followed to increase the capacity.  Indexers are linux based and the replication factor is 3. 


1. Can we increase the storage on the fly without any downtime

2. Will it affect the existing buckets? Any backup is required.


Thanks in Advance 

Labels (1)
Tags (1)
0 Karma


Hi @spl_unker,

If you are using LVM , it is possible increasing partition on the fly. Please check with your system admin. This will not effect the buckets. Otherwise you may need reboot the system or create a new partition and copy the buckets to new partition.

In any case, it is better enable maintenance mode first, doing resize operation on one indexer at a time and disabling maintenance mode after each indexer to allow cluster master make necessary fix ups.  This will also prevent data loss in case of a failure on one indexer.

If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!